Mangler en person til at kigge på en hijackthis-log-fil for mig

Du kan jo starte med at installere SP2, og alt hvad der eller er her..  http://windowsupdate.microsoft.com/
 
Derefter kan du jo køre et spyware program...

http://arlet.dk/spywarescanner.htm

DU BØR (=SKAL) IKKE INSTALL SP2 PÅ EN 'SNAVSET' PUTTER !!!

Og der ER masser af snavs på din putter!!!

Følg vejledningen i denne artikel:
http://www.eksperten.dk/artikler/954

(Ikke nødvendigvis mig der følger op..)

Bla. disse ser jo 'sjove' ud:
O4 - HKLM\..\Run: [defender] C:\\defender22.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard22.exe
O4 - HKLM\..\Run: [newname] C:\\newname22.exe

og >10 andre 'snavs'/virus linier... Velkommen i klubben...

jaja, jeg kigger på det :/

for resten; "Fejl under indlæsning af C:\WINDOWS\System32\flpwin.dll
Det angivne modul blev ikke fundet"

Er det noget uopretteligt slemt noget? :S

Jo den hører til 'snavset' ->
http://fileinfo.prevx.com/QQd3eb21241207-FLPW16403570/FLPWIN.DLL.html

Men som sagt/skrevet:
Følg vejledningen i denne artikel:
http://www.eksperten.dk/artikler/954

Så skal putter nok blive go' igen...

De linier Dr1 påpeger er Alcan infektionen, men lad os se hvad scannerne kan gøre, inden der kommer en vejledning.

... nemlig ... jeg vil lade http://www.eksperten.dk/artikler/954 scanner proceduren ta' første omgang...

<fromsej>: Du ruller bare videre - der er jo en del 'forskelligt' mere eller mindre kendte Uønskede elementer på denne putter...

okay.. Det tog længere tid at scanne end jeg havde regnet med så fik det ikke herind igår, men jeg har fulgt artiklen..

DR. WEB SCAN STATISTICS :

Objects scanned: 137839
Infected objects found: 20
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 75
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 2
Hacktool programs found: 1
Objects cured: 0
Objects deleted: 18
Objects renamed: 78
Objects moved: 2
Objects ignored: 0
Scan speed: 1143 Kb/s
Scan time: 00:58:54
(jeg er ikke sikker på om jeg skulle have haft mere af loggen med..)


SUPERANTISPYWARE SCAN LOG :

SUPERAntiSpyware Scan Log
Generated 05/25/2006 at 11:32 AM

Core Rules Database Version : 2948
Trace Rules Database Version: 1057

Memory threats detected  : 0
Registry threats detected : 107
File threats detected    : 38

Adware.Acoona
    HKLM\Software\Classes\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}\InprocServer32
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}\InprocServer32#ThreadingModel
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}\ProgID
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}\TypeLib
    HKCR\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707}\VersionIndependentProgID
    C:\Programmer\Accoona\atoolbar.dll

Trojan.HyperLinker/LinkMaker
    HKLM\Software\Classes\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}\InprocServer32
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}\InprocServer32#ThreadingModel
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}\ProgID
    HKCR\CLSID\{85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1}\VersionIndependentProgID
    C:\WINDOWS\System32\hlwin.dll

Adware.ASearchAssist
    HKLM\Software\Classes\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\InprocServer32
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\InprocServer32#ThreadingModel
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\ProgID
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\Programmable
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\TypeLib
    HKCR\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208}\VersionIndependentProgID
    C:\Programmer\Accoona\ASearchAssist.dll

Unclassified.Unknown Origin
    HKLM\Software\Classes\CLSID\{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}
    HKCR\CLSID\{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}
    HKCR\CLSID\{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}\InprocServer32
    HKCR\CLSID\{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}\InprocServer32#ThreadingModel
    C:\WINDOWS\System32\ssqrs.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}
    HKCR\CLSID\{F2FA09FB-EE7A-46D8-9145-A1EEF7850052}

Adware.WebHancer
    C:\Programmer\WEBHANCER\Programs
    C:\Programmer\WEBHANCER
    C:\Programmer\whInstall\Sporder.dll
    C:\Programmer\whInstall\webhdll.#ll
    C:\Programmer\whInstall\whAgent.#xe
    C:\Programmer\whInstall\whAgent.ini
    C:\Programmer\whInstall\whiehlpr.#ll
    C:\Programmer\whInstall\whInstaller.#xe
    C:\Programmer\whInstall\whSurvey.#xe
    C:\Programmer\whInstall
    C:\WHCC2.exe
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\OPA98REN\WHCC2[1].exe

Trojan.NewDotNet
    HKU\.DEFAULT\Software\New.net
    HKU\S-1-5-18\Software\New.net

Trojan.NetMon/DNSChange
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#Type
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#Start
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor#ObjectName
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Security
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Security#Security
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\Network Monitor\Enum#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#Contact
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#DisplayVersion
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#NoModify
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#NoRemove
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#NoRepair
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A394E835-C8D6-4B4B-884B-D2709059F3BE}#UninstallString
    C:\Programmer\Network Monitor

Trojan.cmdService
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Type
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Start
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ObjectName
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Security
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Security#Security
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#NextInstance
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#Contact
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#DisplayVersion
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#NoModify
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#NoRemove
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#NoRepair
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877C2CD-F137-4144-BDB2-0A811492F920}#UninstallString
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#DeviceDesc

Adware.TargetSavers
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA#UninstallString

Adware.Adservs
    C:\WINDOWS\system32\atmtd.dll
    C:\WINDOWS\system32\atmtd.dll._

Trojan.SmartLoad
    HKLM\Software\Microsoft\drsmartload2
    HKLM\Software\Microsoft\drsmartload2#Installed

Browser Hijacker.Internet Explorer Settings Hijack
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Start Page [ http://www.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Start Page [ http://www.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Search Bar [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Search Bar [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]

Trojan.Unknown Origin
    C:\Documents and Settings\Strægaard\DoctorWeb\Quarantine\cmdinst.exe
    C:\Documents and Settings\Strægaard\DoctorWeb\Quarantine\installer[1].exe
    C:\WINDOWS\UmFzbXVzIFN0cmFlZ2FhcmQ\oAIWvrpWKIhXwAI5tZI1wAk.vbs
    C:\WINDOWS\uninstall_nmon.vbs

TargetSaver, Inc. Process
    C:\Documents and Settings\Strægaard\Lokale indstillinger\Temp\GLF53GLF53.EXE
    C:\WINDOWS\system32\tsuninst.exe

Adware.NicTech Networks
    C:\WINDOWS\Installer.#xe
    C:\WINDOWS\system32\dEtaclen.#ll
    C:\WINDOWS\system32\dn2401fqe.#ll
    C:\WINDOWS\system32\dnjo0113e.#ll
    C:\WINDOWS\system32\e0020adoed0c0.#ll
    C:\WINDOWS\system32\fp6203joe.#ll
    C:\WINDOWS\system32\k6lq0g35e6.#ll
    C:\WINDOWS\system32\kodsl.#ll
    C:\WINDOWS\system32\mbsip32.#ll
    C:\WINDOWS\system32\ngmarta.#ll
    C:\WINDOWS\system32\o448lehu1h48.#ll
    C:\WINDOWS\system32\whdtrace.dll

Trojan.PreUninstallHL/32
    C:\WINDOWS\system32\PreUninstallHL.exe


HIJACKTHIS LOG-FIL :

Logfile of HijackThis v1.99.1
Scan saved at 11:36:28, on 25-05-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Microsoft Hardware\Keyboard\type32.exe
C:\Programmer\Google\Gmail Notifier\gnotify.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Documents and Settings\Strægaard\Skrivebord\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400055&utm_content=leftnav&utm_source=wdz3&utm_medium=bund&utm_campaign=wdz0805
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IntelliType] "C:\Programmer\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [defender] C:\\defender22.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard22.exe
O4 - HKLM\..\Run: [newname] C:\\newname22.exe
O4 - HKLM\..\Run: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKLM\..\RunServices: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - C:\WINDOWS\System32\hlwin.dll
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\mpxml3r.dll
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ssqrs - ssqrs.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe



:o der er dælme meget, kan ikke selv finde hoved og hale i det.. Bør jeg åbne en ny tråd herinde på eksperten om alt det her?

StandBy - afvent <fromsej> ...

-- Hent Brute Force Uninstaller, og pak det ud til sin egen mappe (c:\BFU):
http://www.merijn.org/files/bfu.zip

-- Højreklik på følgende link, og vælg "Gem som" for at downloade Alcan Remover. Gem det i samme mappe som du gemte Brute Force Uninstaller i (c:\BFU):
http://metallica.geekstogo.com/alcanshorty.bfu
---------------------------------------
Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret (tryk på <F8> under opstarten), kør Bfu efter vejledningen, slet derefter mapper og filer listet længere nede.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400055&utm_content=leftnav&utm_source=wdz3&utm_medium=bund&utm_campaign=wdz0805
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [defender] C:\\defender22.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard22.exe
O4 - HKLM\..\Run: [newname] C:\\newname22.exe
O4 - HKLM\..\Run: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKLM\..\RunServices: [Microsoft Internel Corporat ] smbvhost.exe
O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - C:\WINDOWS\System32\hlwin.dll
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\mpxml3r.dll
---------------------------------------
-- Klik på "Min computer", og naviger frem til c:\BFU mappen. Dobbeltklik på BFU.exe. Så åbnes "The Brute Force Uninstaller". Til højre for det øverste indtastningsfelt, skal du nu klikke på det gule mappe-ikon ("Open script file"), og navigere frem til alcanshorty.bfu, som du hentede tidligere:
c:\bfu\alcanshorty.bfu

Klik herefter på "execute", og lad programmet gøre sit arbejde. Når scriptet er færdig, klikker du på OK, og derefter på EXIT.
---------------------------------------
Sletning af \mapper\ og filer:
Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
<Ingen>
-------------------
Filer:
C:\defender22.exe
C:\keyboard22.exe
C:\newname22.exe
C:\WINDOWS\system32\mpxml3r.dll
smbvhost.exe
---------------------------------------
Genstart normalt og kom med en frisk Hijackthislog.

Logfile of HijackThis v1.99.1
Scan saved at 18:02:37, on 26-05-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Microsoft Hardware\Keyboard\type32.exe
C:\Programmer\Google\Gmail Notifier\gnotify.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Strægaard\Skrivebord\Systemtools\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IntelliType] "C:\Programmer\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ssqrs - ssqrs.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Fix denne:
O20 - Winlogon Notify: ssqrs - ssqrs.dll (file missing)

Genstart, så er loggen ren, vi behøver ikke se flere.

Du bør lige deaktivere systemgendannelse, genstarte og genaktivere samt sætte filvisning til normal.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.
Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis ikke skjulte filer og mapper".

For at holde den ren kan du kigge på vores pakke til formålet.
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://fromsej.dk/html/avoid.html
Mvh:
Fromsej/Team Spywarefri.

jeg takker, fromsej.

Velbekomme, tak for point. :-)